safety
Scan dependencies for known vulnerabilities and licenses.
Decision gist · record as of 2026-08-14
Yes, if you need Python dependency vulnerability scanning. Safety CLI is actively maintained, has low install friction, and integrates well into CI/CD workflows. The free tier is limited but available; commercial use and comprehensive coverage require a paid plan. No known vulnerabilities in the package itself as of the fact sheet date.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python >=3.9.
- Authentication is required to run scans; the tool will prompt for account creation or login on first use.
- Low install friction with a pure-Python wheel distribution.
License · maintenance · safety
MIT (permissive) — Released under the MIT License (permissive), so you can use it freely in commercial and private projects. A free tier is available after a 7-day trial, though the full vulnerability database requires a paid plan.
last release 2026-05-29 (77 days) · last repo commit 2026-07-21 · 1,995 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 5,775,644 downloads/mo, #2,040 on PyPI
Alternatives
Verify before relying
pip install safety
safety auth
safety scan- Whether the free plan's vulnerability database coverage is sufficient for your project's security requirements
- How the tool's remediation suggestions align with your dependency management workflow
- Performance characteristics when scanning large monorepos or projects with many dependencies
What it is and what it does
Safety CLI is a command-line tool that scans Python project dependencies against a vulnerability database to identify packages with known security issues and detect malicious packages. It integrates into development workflows, CI/CD pipelines, and production systems to catch supply chain risks early. The tool can output findings in multiple formats (JSON, SBOM, HTML, text) and optionally apply automated fixes to update vulnerable dependencies to secure versions.
The package depends on a suite of common Python libraries—httpx for HTTP requests, pydantic for data validation, typer for CLI structure, and others—to deliver scanning, authentication, and reporting. It requires Python >=3.9 and is actively maintained with recent releases. A free tier is available after an initial trial period, though access to the full vulnerability database requires a paid subscription.
Use it for
- Scan a local project directory before committing code to detect vulnerable dependencies early in development
- Integrate into GitHub Actions or other CI/CD pipelines to block builds when high-severity vulnerabilities are found
- Automatically remediate vulnerable dependencies by running `safety scan --apply-fixes` to update requirements files
- Generate SBOM or JSON reports for compliance audits and supply chain transparency documentation
- Monitor system-wide dependencies on developer machines to detect risks in installed tools and runtimes
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need Python dependency vulnerability scanning.
Safety CLI is actively maintained, has low install friction, and integrates well into CI/CD workflows. The free tier is limited but available; commercial use and comprehensive coverage require a paid plan. No known vulnerabilities in the package itself as of the fact sheet date.
Install
safety on PyPI
Before you install
Low install friction with a pure-Python wheel distribution. The package is actively maintained with recent releases and carries 19 runtime dependencies including httpx, pydantic, and click—a moderate but manageable dependency footprint for a security scanning tool.
Requires Python >=3.9. Authentication is required to run scans; the tool will prompt for account creation or login on first use.
License in practice
Released under the MIT License (permissive), so you can use it freely in commercial and private projects. A free tier is available after a 7-day trial, though the full vulnerability database requires a paid plan.
Quickstart
pip install safety
safety auth
safety scanVerify before relying
- Whether the free plan's vulnerability database coverage is sufficient for your project's security requirements
- How the tool's remediation suggestions align with your dependency management workflow
- Performance characteristics when scanning large monorepos or projects with many dependencies
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 19 packagesauthlibcertificlickdparsefilelockhttpxjinja2marshmallownltkpackagingpydanticruamel-yamlsafety-schemastenacitytomlitomlkittruststoretypertyping-extensions |
| Maintenance | Actively maintained 77 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 5,775,644 / month, #2,040 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersIntended Audience :: Information TechnologyIntended Audience :: System AdministratorsIntended Audience :: Telecommunications IndustryLicense :: OSI Approved :: MIT LicenseNatural Language :: EnglishOperating System :: MacOSOperating System :: Microsoft :: WindowsOperating System :: POSIX :: LinuxProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.9Topic :: Security |
Evidence: safety-3.8.1-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “check python packages for vulnerabilities”
- safetySafety CLI scans Python project dependencies for known…
- pip-auditpip-audit scans Python environments and requirements files for…
- debsecan-mcpAn MCP server that scans Debian systems for known security…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also guarddog · pysentry-rs · sealights-python-agent · ca9 · uv-secure · pip-audit · picklescan · pipmaster · pysnyk · pyre-check